http://www.informit.com/articles/article.asp?p=342259 By Steven Branigan, Seth Fogie. Date: Oct 22, 2004 Stephen Branigan, one of the founders of the New York City task force on cybercrime and author of High-Tech Crimes Revealed: Cyberwar Stories from the Digital Front [1], talks to Seth Fogie about hacker motivations and how to solve cyber crimes. Seth: Who are your real-life influencers? Fictional influencers? (With regard to this book's subject, that is.) Steven: Real life influencers: * Police: Sergeants J. Cheney and Richard "Fox" Foster taught me all the real-life lessons of patrolling the streets that the academy hadn't. * Network security: My friends Bill Cheswick, Matt Blaze, Steve Bellovin, Avi Rubin, and Hal Burch have helped shaped my views on how to conduct secure networking and secure computing. * Legal: Scott Charney and Martha Stansel-Gamm have each led the Computer Crime and Intellectual Property Section of the Department of Justice, and they always seem to know how to balance the competing forces of protecting the innocent and convicting the guilty. Seth: If you can give us a name and brief summary, who was the most talented hacker you ever caught and what did he/she/they do? Steven: I'm generally uncomfortable with giving the names of the hackers caught, as I would be hesitant to provide the names of anyone I arrested. It's better for the subjects, should they wish, to provide that information. With that said, I believe that one of the best was the "hot-ice" character detailed in Chapter 2 of my book. Technically very competent, and able to maneuver across country boundaries very well. The character "Bob" from Chapter 6 was possibly the brightest hacker I ever met. Seth: Do you attend any hacker conferences? What's your opinion about their focus and content? Have you ever been tagged in "Spot the Fed"? Steven: Actually, I haven't been to a single hacker conference. I guess it's because I would expect to be handed a "Fed" T-shirt at the door as I walked in! Seth: There's a lot of discussion in this book about the motivators of a hacker, and most of it is right on! I myself would fall into the curious category. :) However, IMHO, these are the same motivators that drive almost everything and everyone.... What motivated you to write this book? Steven: Motivations for me? Here goes: * I think that computer crimes are very misunderstood. This book explains who does them, why they do them, and what the impacts can be. * Further, I know that as people become more aware of what computer crimes are, they will be able to make better decisions about how to protect their networks. Seth: Throughout the book, chance seems to play a paramount role in finding and catching talented hackers. What's your experience with the reality of this unnerving concept? What chance do we have if we never see them coming? Steven: An over-used clich applies here: It's better to be lucky than good. I believe that there's an element of luck in catching criminals. And that really is a frightening concept. The good news is that criminals always take a chance when they commit a crime. We can use that in our favor. That's why I'm a big fan of improved logging and surveillance. Audit trails are an incredible resource for trying to catch a hacker after you discover the problem. Seth: The book discusses how to handle a break-in and the significant damage that can be done by not following proper protocol. However, in many of your cases, you have prior evidence of hacker activity. What's the proper protocol for addressing a computer that may or may not be a hacker tool-for example, troubleshooting a malfunctioning computer and finding 3GB of warez and four rootkits causing the problem? Steven: I would suggest that in a couple of the cases, it wasn't that there was initial evidence of hacker activity. For example, in Chapter 3, our friend Wesley's hacking was discovered because he hadn't paid his rent. Let me say that it was the methodical investigations that ultimately led to us uncovering the hacker activities in Chapters 1 and 3. My best advice is to walk that fine line between trust and suspicion when investigating computer malfunctions. Maybe it's nothing, or maybe it's the work of a hacker... Seth: While it would be nice for everyone to get fair play with the FBI when a hack occurs, they're limited on time and resources, and not everything requires FBI-level attention. Based on your experience, what kind of support/interest can a SOHO user expect from the authorities (local police, FBI, state police, and so on)? Steven: I agree that not everything needs FBI-level attention! That's a very important point. Law enforcement really, really wants to do the right thing. I have been very fortunate to have worked with many cops around the world who work hard to protect their citizens. Many state and local police agencies are getting much better at handling computer crime issues. They're very interested in dealing with these issues, and the issues they deal with directly translate into the training they'll receive in the future! My best advice, should you find yourself in a position where you need [law enforcement assistance], is to be sure to take the time to explain how the crime has affected you personally. Seth: I grew up in a cop's family, and I know a little of how being a cop changes your perspective on life. I can see some of this perspective in your book, and it's a refreshing reading experience, especially since most other books are written by "hackers." What's your take on these other books? Steven: I spent a lot of time reading publications such as 2600, phrack, and the like. To be honest, I have never really been sure what the justification is for hacking into telephone systems, cellular systems, banks, and so on. Whether it's invasion of privacy, theft of services, or even fraud, computer crimes usually result in real victims. I think that is often missed with the anonymity that computers and the Internet provide. Seth: This book addresses the options available to a company after a system compromise. What's your personal recommendation to companies facing that catch-22 situation where they learn their server is host to hacker activity, but they can't shut it down until the end of the day or even week? Steven: Hmm... No matter which option you choose, at some point the other option will have seemed better! It's a tough call that needs to be made by the business leaders with expert consultation from their technical people, because either option is a business-impacting operation. Usually it depends on the severity of the suspected attack and the ability to investigate while continuing operations. Those are the most relevant factors. Seth: One of the first pages in the book outlines your work experience based on your attire. I noticed that you served time as a cop (pun intended). How has this helped and hindered your computer security experience? Steven: Served time indeed! * Helpful: Law enforcement encourages you to document your activities, and that's very helpful for computer security. It taught me to follow up on even the smallest of suspicious items. I remember very well the story from my academy days of a police officer who broke a large cocaine ring just by stopping a car with an expired inspection sticker. That one stop led to the discovery that the driver's license was revoked. That led to finding there was a warrant for his arrest. And that led to the subject giving up information... It taught me that even when you may think someone has done something wrong, always treat all people equally until you have proof. * Harmful: I get suspicious very easily, perhaps too easily. Seth: On the subject of careers, what advice can you give to people who find computer security an attractive field? Is there a fast path to getting a job as a forensics specialist with a police department? Steven: Free advice (and remember, money back if you are not delighted!): I will limit this to legitimate jobs with the police, and exclude the attractive career of confidential informants. Law enforcement is looking for reliable, trustworthy people with excellent technical skills. Look into a computer security or forensic problem and help solve it. Present your results at a conference. That will help to get you noticed. Seth: On the same subject, you [wondered] why anyone would write a program like NetStumbler. Why do you think NetStumbler was written? Steven: I have no idea why it was written and given away for free! While I imagine that curiosity and conquering the technical challenge inspired the initial writing, I'm not sure why the authors didn't release it as a commercial product. Seth: What are your interests outside your industry? Steven: Sports. In particular, soccer (which I play often), baseball, and football. I find that I'm always learning from playing or watching team sports. Seth: Have you ever downloaded an "illegal" MP3? Steven: I have tried napster/aimster and gnutella. I discovered that it was incredibly easy to find and download MP3s. They certainly proved a serious threat to the music industry. I downloaded "The Cars-Door to Door" (from a CD that I had already purchased). The quality of the download was not very good. The version I ripped from my CD was better. Ultimately, it's important that artists have the chance to be rewarded for their work. That's why downloading copyrighted MP3s is wrong, and is a problem for the industry. And that's why I'm pleased to see that iTunes, Musicmatch, Wal-mart, Amazon.com, and others are now selling MP3 singles over the Internet. I think that most people want to do the right thing and pay for a song, and now they have the opportunity to do so. I think that this will be the most effective strategy to get the majority of the people to stop illegal copying of music. Seth: The book discusses some of the difficulties authorities face as a result of boundaries. How is globalization changing this situation? Are things getting easier for the good guys when trying to track down and stop the bad guys? Or is globalization not affecting this arena? Steven: Globalization and the Internet are inseparable. I am cautiously optimistic about the progress that has been made over the past few years with multinational organizations such as the G-8, North Atlantic Treaty Organization (N.A.T.O.), and the Organization of American States (OAS). They're working very hard at making transnational computer crime investigations easier for law enforcement. Seth: Government and big business are repeated targets for the hackers in the book. Are they easier targets, and are they aware of the threats of a hacker attack? How are they dealing with it? Steven: I don't think it's that they're easier targets. I think that both government and big business are attractive targets because they're perceived to have interesting information. They're also better able to detect attacks than home users are. Not many home users track the number of times hackers are attacking them. But I do! Just a quick look at my August 2004 stats [2] reveals that this one system was attacked 154 times in one month! The best I've seen are dealing with the threats by: * Improving awareness among their people * Improving the technology that they use to secure their networks * Re-architecting their infrastructure to limit the damage from a single hacker attack Seth: What's your normal workday like? Do you spend a lot of time traveling? Steven: There's no such thing as a normal workday for me! I'm devoting my efforts to growing CyanLine [3], my new company which is focused on "untethered" security. Seth: What are some of your favorite security books? Steven: * Firewalls and Internet Security: Repelling the Wily Hacker by William Cheswick, Steven M. Bellovin, and Aviel D. Rubin (Addison-Wesley, 2003, ISBN 020163466X) http://www.amazon.com/exec/obidos/ASIN/020163466X/c4iorg * Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage by Cliff Stoll (Pocket, 2000) 0743411463 http://www.amazon.com/exec/obidos/ASIN/0743411463/c4iorg * Masters of Deception: The Gang That Ruled Cyberspace by Michelle Slatalla and Joshua Quittner (Perennial, 1996) http://www.amazon.com/exec/obidos/ASIN/0060926945/c4iorg Seth: Do you ever work with "Whitehat" hackers? What do you think of this practice (hacking with the intention of bringing security holes to light, without the intention to cause harm)? Steven: I am a little uncomfortable with the term Whitehat hacker. I love the computer security research community that has proven their ability to discover weaknesses and bring them to light in a way that doesn't cause harm. They're successful because they're self-policing and they use peer review. Without these controls in place, it's hard to ensure that you're truly not causing harm [1] http://www.amazon.com/exec/obidos/ASIN/0321218736/c4iorg [2] http://www.sbranigan.com/stats/Aug-2004.html [3] http://www.cyanline.com/ _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Mon Oct 25 2004 - 04:31:22 PDT